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Learning to be Watched: Surveillance 
Culture at School 

The Eighteenth Annual Report on Schoolhouse 
Commercializing Trends, 2014-2015 

Faith Boninger and Alex Molnar, University of Colorado Boulder 


Executive Summary 

Digital technologies used by marketers continue to evolve. Sophisticated and personalized, 
they help ensure that today’s children and adolescents are constantly connected and avail¬ 
able to advertisers wherever they may roam. Moreover, because digital technologies en¬ 
able extensive personalization, they amplify opportunities for marketers to take over not 
only public space but also individuals’ private space. In this year’s report, we consider how 
schools facilitate the work of digital marketers and examine the effects of their relentless 
tracking of and marketing to children. 

Schools now routinely direct students online to do their schoolwork; and they collect stu¬ 
dent data using education and recordkeeping software that is useful to marketers as well- 
creating a threat to students’ privacy. Schools’ embrace of digital technology augments and 
amplifies traditional types of education-related marketing, which include: (l) appropriation 
of space on school property, (2) exclusive agreements, (3) sponsored programs and activi¬ 
ties, (4) incentive programs, (5) sponsorship of supplementary educational materials, and 
(6) fundraising. These marketing efforts, conducted with the implicit blessing of adminis¬ 
trators, teachers, and parents, combine to normalize for children the notion that corpora¬ 
tions have a legitimate role in their education and in their lives more generally. In addition 
to threatening children’s right to privacy, these practices raise serious concerns about their 
effect on children’s physical and psychological well-being and about their impact on the 
integrity of the education children receive. By engaging in these practices, schools abet the 
socialization of students as consumers who take for granted that others have a right to keep 
their behavior under constant surveillance for marketing purposes—even at the cost of their 
own well-being. 


Recommendations: 

It is recommended that: 

1. Parents, teachers, and administrators—as individuals and through their organiza¬ 
tions—work to make public the threats that branded programs and materials, as 
well as unregulated digital technologies, pose to children when they are allowed 
into schools and classrooms. 

2. The Federal Trade Commission extend the Children’s Online Privacy Protection 
Act (COPPA) protections to age 14 and strengthen the protections offered to ado¬ 
lescents ages 15-18. 1 




3. Industry self-regulation not be relied upon to protect the interests of students. In¬ 
stead, policymakers should adopt enforceable legislation that holds schools, dis¬ 
tricts, and companies with access to student data accountable for violations of stu¬ 
dent privacy. 

4. Legislators carefully review proposed legislative language to ensure that it does not 
contain loopholes that provide companies with opportunities to collect and exploit 
children’s data while also “following the letter of the law.” 

5. Those designing and reviewing relevant policies ensure that policies protect the 
privacy not only of student educational records but also of the wide variety of stu¬ 
dent data (including anonymized data) now being collected and shared. Such pol¬ 
icies should explicitly address the potential commercial use of any data collected. 

6. School district and privacy specialists review contracts with educational technology 
and other providers to check specifically for provisions or omissions that enable 
third parties to monitor and/or exploit students for commercial gain. 

7. Policymakers at every level seek to eliminate perverse incentives that encourage 
parents, teachers, and administrators to sacrifice student privacy in an effort to 
financially support educationally necessary school activities. 
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Learning to be Watched: Surveillance 
Culture at School 

The Eighteenth Annual Report on Schoolhouse 
Commercializing Trends, 2014-2015 


Hello Everyone, 

This Thursday, December 10th, will be Bring Your Own Technology Device 
(“BYOD”) Day for Ventura School! Your child can bring their own tech¬ 
nology device (IPhone, IPad, ITouch, Samsung Galaxy, etc...) to school. 

If your child does not have their own technology device, we will have at 
least 10 IPads in class or they can pair up with another student and share 
their device together. We will have fun, challenging technology activities 
that day! 

One activity the students will be doing that day are with QR (Quick Re¬ 
sponse) Codes. Students will be working out math problems that they have 
been learning in class, in a scavenger hunt form using the QR codes. In 
order for your child to do this activity, I would like to request that you 
download this free app onto their device before Thursday. 

There are several different scanning apps that students can download on 
their own devices for FREE. 

* Quick Scan - QR Code Reader - I personally downloaded on my IPhone 

* QR Reader - downloaded on all Ventura Ipads 

I have found that these work the same, so it may not matter which free 
scanning app they download. 

Thanks for your support! 

Sincerely, 

Mrs. Hill 

(teacher letter to parents, December 2015 2 ) 


Ethan is a student in Mrs. Hill’s third grade class. 3 Because his parents are concerned about 
the negative effects of technology use among children, he had no personal device (iPhone, 
iPad, or otherwise) to bring to school for BYOD Day, or to which he could download his own 
QR code reader. He did, however, participate in the day’s activities using one of the school’s 
iPads, and he learned how to use it to read QR codes. Now that he knows just how handy 
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those ubiquitous little codes are, when he gets a smartphone, perhaps he will download his 
own reader. And if there is no cost to him to do so, chances are good that it will collect infor¬ 
mation from his phone that will be used to serve him targeted advertisements. 4 


A Short History of Commercialism in Schools 

Efforts to exploit students like Ethan for commercial gain are nothing new. In fact, the first 
documented example of marketing in schools dates from the 1890s, when a hardware store 
tried to put materials into schools with its marketing slogan on it. 5 By the 1920s, the phe¬ 
nomenon of companies offering supplementary materials to schools had grown so much 
that the National Education Association empanelled the “Committee on Propaganda in the 
Schools” to examine it and offer teachers guidelines for how to evaluate the many materials 
they received. 6 

Since 1998, our Commercialism in Education Research Unit annual reports have examined 
trends in schoolhouse commercialism in the context of general marketing trends, especially 
with respect to marketing to children. Since the 1890s, and certainly since we began fol¬ 
lowing the phenomenon in the 1990s, efforts to promote products, brands, and corporate 
worldviews—both in schools and out—have retained their essential character even as their 
sophistication has steadily grown. 


What is Constant? 

The purpose of marketing—that is, to influence its targets’ attitudes and behaviors—is al¬ 
ways the same. In schools, because the targets are children who are compelled under law to 
attend, an important part of the goal is to exert influence at an early age, to establish atti¬ 
tudes that will affect a lifetime of purchases. This has been the purpose ever since companies 
first began offering their propaganda for free to schools. 

The basic commercial values and activities of marketing have also remained constant. Defi¬ 
nitions of “commercialism” typically point to it as a value system that privileges profit above 
every other concern. 7 “Marketing,” an integral element of commercialism, refers to any type 
of promotional activity intended to bring together a brand and its customers; “advertising,” 
a subset of marketing, consists of the creation and delivery of specific messages presented 
to potential customers via print or other media. 8 These fundamental identities have not 
changed over the years. 

Moreover, all marketing promotes the values, stories, and morality of a consumer culture- 
regardless of the product being marketed or the apparent innocuousness of any given ad¬ 
vertisement. 9 No matter where it appears, marketing to children is intended to shape how 
children see themselves and how they think about their world, including their families, 
friendships, romantic relationships, and experiences. 10 No one particular advertisement or 
marketing campaign has this effect on its own, but each contributes to framing the values of 
consumption and consumerism as the highest good. 11 

Another way of thinking about this is that while each advertisement may promote a differ¬ 
ent product, all advertisements reinforce the same underlying worldview: that the path to 
happiness and satisfaction lies through consumption. This powerful belief is all the more 
effectively taught because it is promoted invisibly as an a priori assumption and is therefore 
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seldom questioned. 12 ’ 13 

Marketers use a variety of techniques to promote consumption, and many of these tech¬ 
niques have also essentially stayed the same. We organize school commercializing activities, 
in particular, into seven categories: (l) appropriation of space on school property, (2) exclu¬ 
sive agreements, (3) sponsored programs and activities, (4) digital marketing, (5) incentive 
programs, (6) sponsorship of supplementary educational materials, and (7) fundraising. 14 

Many of the wide variety of commercializing activities in schools advertise particular prod¬ 
ucts, but some are designed to promote a worldview consistent with and favorable to that 
of a given company or industry. For example, Energy Balance 101-sponsored educational 
materials promoted by Together Counts and the Healthy Weight Commitment Foundation 
present the food industry’s “calories in-calories out” perspective on nutrition, fitness, and 
weight. 15 

Other activities “commercialize” children by encouraging them to adopt a profit-oriented 
value system without necessarily promoting any particular company or industry. School 
fundraising efforts can do exactly this when they encourage children to capitalize on their 
relationships with family and friends in order to collect donations from them or convince 
them to buy things they don’t want in order to support the school. 16 In a very different exam¬ 
ple, Ethan’s school served the marketing industry itself by encouraging students to down¬ 
load and use QR readers: it introduced the children to a form of marketing technology that 
has not caught on among older consumers. 17 


What Has Changed? 

Over the past century, marketing and advertising have increasingly encroached on public 
space, including schools. 18 It is no longer news, for example, that formerly ad-free places, 
such as parks and ball fields, are now named for sponsors and bear ads on nearly every inch 
of available space. 

So-called “native advertising,” “content advertising,” or “sponsored content” further inte¬ 
grates advertising into editorial space that was previously off-limits. Whereas publishers 
once clearly demarcated advertising from other content in their offerings, print and online 
publishers now present material that looks just like their regular content but is, in fact, pro¬ 
duced by advertisers. 19 This merging of advertising and content is embraced by companies 
looking for new ways to promote their products, by publishers desperate to hold off their 
imminent extinction, and by advertisers threatened by the popularity of “ad-blockers” that 
screen out obvious advertisements. 20 

In schools, all marketing is “native.” When Ethan learns how to scan QR codes as part of a 
math game, for example, it is embedded marketing for a technology that serves marketers 
much more than it serves him. 21 Likewise, when he participates in his school’s running club, 
which is sponsored by the local Nike store, it is embedded marketing for Nike. 22 And when he 
learned passing and running skills at a football camp as part of a “Super Kids - Super Shar¬ 
ing” event, it was embedded marketing for the National Football League (NFL). 23 

The technology for delivering marketing has become more sophisticated and personal, help¬ 
ing to ensure that today’s children and adolescents are constantly connected and targeted 
by advertisers wherever they may roam. In 1998, we predicted that the nascent Internet 
would increase the amount of electronic (digital) marketing to children in schools. 24 We 
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had no idea! In 2016, the omnipresence of cell phones, tablets, and computers amplifies the 
possibilities for marketing to colonize public space. The use of these technologies in school, 
in the forms of specifically-designed “education technology” and commercial applications 
modified for school use, transforms how children are taught, tracked, and marketed to. 

Digital marketing is now easily personalized—micro-targeted to each individual based on 
her browsing history and other information that marketers attach to her profile. This level 
of sophistication necessarily makes digital marketing intrusive. One way of thinking about 
this is as information being “pushed” and “pulled.” “Old-fashioned” advertising is fully of 
the “pushing” sort: marketers push information at the target individual in hopes she will 
pay attention to and be influenced by it. Modern advertising also incorporates “pulling”: 
marketers extract personal information from the target so that they can more effectively tar¬ 
get marketing to her specific interests and needs. Collecting publicly available information 
(demographics and home ownership, for example) to segment television audiences is an 
especially coarse form of “pulling” information. Tracking Facebook “likes,” browsing histo¬ 
ries, or smartphone location data are much more sophisticated and finely-tuned variants. As 
one article in Advertising Age put it, “Collecting data about customers is virtually as old as 
marketing itself, but the trillions of data points now available online make it a sophisticated 
piece of weaponry.” 25 

Although it remains possible to pull information about a target non-digitally (as when mar¬ 
keters buy lists of new homeowners, etc.), digital technology maximizes how much informa¬ 
tion is available and how easily it can be transferred; information gleaned from digital be¬ 
havior can then be combined with information pulled from off-line sources. 26 The individual 
may see the same number of advertisements as she would have otherwise, but increasingly 
the advertisements are personally tailored to her based on her online behavior and on other 
digital information, such as her smartphone location data and contact lists. Such informa¬ 
tion collection and targeting raises concerns about violations of privacy. 27 


Focus of this Report 

School-based marketing efforts are commonly conducted with the blessing and sometimes 
active participation of school boards and/or governance boards, administrators, teachers, 
and parents. In the first half of this report, we provide current examples of these market¬ 
ing efforts and explore how they normalize the participation of corporations as benevolent 
“partners” both in children’s education and in their larger lives. 

In the second half of this report we examine how digital marketing, especially in and through 
schools, amplifies opportunities for marketers to take over virtual and real school space and 
invade the private space of students. In prior annual reports, we documented the lack of ef¬ 
fective policy to regulate commercialism in schools, and we examined state and federal pol¬ 
icy regarding student privacy. 28 Here, we turn our attention to the implications for children 
of being tracked and of experiencing constant digital marketing. 

Specific concerns relate: to violations of children’s privacy; to threats to children’s physical 
and psychological well-being and to the integrity of their education; and, to their socializa¬ 
tion as consumers above all else—consumers who take for granted the constant surveillance 
of their behavior by data-gathering entities for purposes that threaten their well-being. 
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Commercializing Activities in Schools 2015-2016 

“How is it that corporations can masquerade as do-gooders for our schools, when 

the reality is their motives are less than pure?” 

(J., at ParentTech.org) 29 

We organize school commercializing activities into seven categories: (l) appropriation of 
space on school property, (2) exclusive agreements, (3) sponsored programs and activities, 
(4) digital marketing, (5) incentive programs, (6) sponsorship of supplementary education¬ 
al materials, and (7) fundraising. 30 There are many individual examples to be found, 31 but 
particularly noteworthy are campaigns that target children using several coordinating ap¬ 
proaches that manipulate teachers, administrators, and parents to direct children’s atten¬ 
tion toward sponsors’ interests. 32 

Civil society organizations and parent activists took both the National Football League (NFL) 
and McDonald’s, in particular, to task this year for their activities. 33 These corporations offer 
programs to schools in their own names and also make use of strategic partnerships, espe¬ 
cially with non-profit or governmental organizations, to further their public relations out¬ 
reach into schools. 34 They portray themselves as concerned with students’ health and with 
the quality of their education, and they structure relationships with education stakeholders 
in ways that make it appear that their involvement in education is helpful, logical, and ben¬ 
eficial for students. 

On their face, the corporations’ free programs, teaching materials, and fundraising appear 
to bolster schools’ efforts to teach important skills and values. Dig a little deeper, howev¬ 
er, and it becomes clear that the offerings are, in fact, self-interested campaigns that use 
schools to develop marketing relationships both with stakeholders and with the children 
themselves. 35 In addition to providing schools with physical advertisements (in the form of 
branded posters promoting healthy eating, for example), these coordinated marketing cam¬ 
paigns co-opt children’s and parents’ activities, as described below, to redefine for all the 
meaning of “community partnerships” to specifically include corporations. 


The National Football League: Sponsored Educational Materials, Appropriation 
of Space, Sponsored Programs and Activities, and Incentive Programs 

The NFL partnered with Young Minds Inspired (YMI) and Nickelodeon for its “NFL Rush” 
sponsored educational materials, coordinated with the NFLRUSH.com website and the Nick- 
toons NFL Rush Zone animated television show. These materials, which the NFL stopped 
promoting to schools towards the end of the 2015-2016 school year, helped redirect elemen¬ 
tary school children back to their televisions and computer screens for more football mar¬ 
keting. 36 ' 37 NFL Rush Fantasy—Learn, Play, Score!, a math and language arts curriculum for 
third and fourth graders, directed children to the NFLRUSH.com website to look up player 
statistics and then use math and critical thinking to play “fantasy football” at the league’s 
fantasy football website created just for children. 38 The December activity, for example, pro¬ 
vided children with a playoffs “bracket” to keep track of which teams advance in the playoffs, 
and had them choose players from the playoff teams to construct their own fantasy team. To 
do this, children had to register for and sign in weekly at the NFLRUSH.com website. Activ¬ 
ity pages exhorted children to “Come back every week for the latest player statistics and to 
set your fantasy roster.” 39 Classroom posters advertised the program. 40 
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James F. Thompson, writing about the NFL Rush Zone television show for Adweek, could 
just as easily have been talking about the NFL’s sponsored educational materials when he 
wrote, “This program isn’t about stories; it’s about sales, branding and, ultimately, NFL 
profits.” 41 To the NFL’s credit, it responded to the Campaign for a Commercial-Free Child¬ 
hood’s extensive report on its activities by agreeing to stop promoting fantasy football in 
schools, and it has taken NFL Rush Fantasy—Learn, Play, Score! offline. This does not 
mean, however, that it has abandoned marketing in schools. 

The NFL’s Play 60 program is, ostensibly, its effort to inspire children to engage in physical 
activity. The program is, however, housed at the NFLRUSH.com website, which encourages 
children to engage in mostly sedentary activities promoting NFL football. It features online 
games, apps, fantasy football, links to game footage and player profiles, advertisements for 
its Nicktoons television show, and football telecasts. The league advances Play 60, in effect 
“whitewashing” it, by partnering with the American Heart Association to promote the annu¬ 
al “Play 60 Challenge” for schools. 42 This incentive program urges teachers and students to 
exercise for 60 minutes daily for four weeks in order to win prizes, including a school visit 
from an NFL player, a $2,500 grant for the school, a Super Bowl-oriented VIP NFL Play 60 
event, and an Xbox video gaming system. 43 

Another Play 60 coordinated effort is “Fuel Up to Play 60,” for which the NFL partners with 
the National Dairy Council (NDC) and the United States Department of Agriculture (USDA) 
(The GENYOUth Foundation runs the program; NDC and the NFL co-fund GENYOUth). It 
is likely that these partnerships enhance the program’s reach: Fuel Up to Play 60 reaches 
3,000 schools and 14 million students, according to GENYOUth, and is the largest school 
health initiative in the United States. 44 It also promotes NFL football by offering NFL-brand- 
ed prizes to students: player visits, game tickets, NFL footballs and shirts, teacher and stu¬ 
dent events at local NFL stadiums, and digital prizes. 45 

Finally, the NFL also conducts non-programmatic school-based promotions, such as the 
Super Kids - Super Sharing project it conducted for Phoenix, AZ, elementary school chil¬ 
dren before the Super Bowl held there in 2015. Students helped donate books and sports 
equipment, attended an NFL-sponsored event, and participated in a “Kids Camp” run by an 
Arizona Cardinals player, where they practiced football drills. 46 The NFL has organized this 
project before each Super Bowl since 2000. 47 As do all the other NFL school programs, it 
ensures that even children with no initial interest in football or sports are forced to attend 
not only to football, but specifically to the league’s offerings. 


McDonald’s: Sponsored Programs, Sponsored Educational Materials, and Fund¬ 
raising 

On a December 2014 conference call with investors, McDonald’s U.S. President Mike Andres 
called for McDonald’s franchise owners to increase their presence in schools. 48 McDonald’s 
strong presence in schools takes the forms of assorted sponsored programs, educational 
materials, and school fundraising opportunities. It markets its activities and materials di¬ 
rectly to schools and teachers, and it also financially supports state Parent Teacher Associ¬ 
ations (PTAs), fostering goodwill that encourages PTAs to bring McDonald’s marketing to 
students. 49 

Despite McDonald’s CEO Don Thompson’s claim at the December 2014 shareholders’ meet¬ 
ing that “we don’t put Ronald out in schools,” franchise owners do offer the chain’s spoke- 
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scharacter, Ronald McDonald, free to elementary schools to teach about empathy (“Giving 
Back with Ronald McDonald!”), friendship and cooperation (“A Friendship Adventure with 
Ronald McDonald”), character (“On the Inside”), reading (“It’s Book Time with Ronald Mc¬ 
Donald”), and exercise (“Get Movin’ with Ronald McDonald”). 50 They also distribute cou¬ 
pons with report cards, provide “Passport to Play” physical education and other educational 
materials, offer free meal days for students, sponsor the “McDonald’s All American High 
School Basketball Games,” and offer college scholarships. 51 The Balanced Active Lifestyle 
Grants Program provides $1,000 toward teachers’ efforts to implement “educational pro¬ 
grams that demonstrate an original approach to enhancing their students’ physical fitness, 
nutrition awareness and health education.” 52 McTeacher Night fundraisers entice children 
and their families to McDonald’s restaurants to be served by their teachers. 

In 2015, anti-commercialism activists, nutrition activists, parents and teachers confronted 
McDonald’s about its efforts, particularly McTeacher Nights, Ronald McDonald visits, and 
the marketing to schools of the movie 540 Meals. 53 540 Meals promotes McDonald’s via the 
story of an Iowa schoolteacher’s weight loss while eating a purely McDonald’s diet. As an of¬ 
ficial brand ambassador for McDonald’s, that schoolteacher promoted McDonald’s and the 
importance of choice and balance to middle and high school audiences around the United 
States. 54 When the Maryland PTA endorsed the film on its website, the organization Healthy 
School Food Maryland organized a petition to protest it. 55 


“Fun Runs”: Corporations, Fundraising, and the PTA 

The McDonald’s examples described above demonstrate how fundraising efforts can pro¬ 
vide openings for corporations to market to children and to teach them commercial values 
in school. Sometimes teachers or schools initiate fundraisers, but especially in elementary 
schools, parent groups often organize them. There are several potential problems associated 
with parent-initiated fundraisers. 

When a parent organization accepts “partner” or “sponsor” money from McDonald’s or any 
other corporation, it opens the door to participating in additional activities designed to 
brand children. For example, the Virginia Parent Teacher Association (PTA), which claims 
McDonald’s as a sponsor, has included McDonald’s presentations at its annual convention, 
posts a “golden arches” link on its homepage, and advertises McDonald’s school programs 
elsewhere on its website. 56 Similarly, the Colorado PTA thanks McDonald’s with a link on 
its website for the company’s support of its 2015 convention; it also advertised McDonald’s 
statewide promotion of free breakfast for students on the first day of school. 57 The Maryland 
PTA promoted 540 Meals. 

Further, when they hire private companies to provide fundraising events, “school-affiliated 
entities” such as parent-teacher organizations or booster clubs sign legal contracts obligat¬ 
ing them to conditions set by the companies. These entities are not held to national or state 
laws that govern school contracts or that require schools to protect student data, and their 
contracts may invalidate pre-existing contracts between the schools and the companies in¬ 
volved. 58 Such events often provide opportunities for student data to be collected without 
sufficient limits on its use or adequate protection of student privacy, such as when a web- 
based contribution program collects and posts information about student participants in the 
fundraiser. 

Frank Holmes, for example, became concerned about threats to student privacy when his 
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daughter’s school held a “Boosterthon Fun Run” as a PTA fundraiser. 59 Boosterthon is one of 
several companies that provide similar turn-key fun run fundraisers: for usually 40-60% of 
the money raised, company employees visit classrooms to motivate children to solicit pledg¬ 
es and provide “character lessons”; provide an Internet-based system by which pledges can 
be made; and set up, manage, and clean up after the run. 60 

Mr. Holmes was initially disturbed that the company posted personally identifying informa¬ 
tion about children online as part of its automated pledging system, although the more he 
learned about the Boosterthon method, the more aspects of it he questioned. For at least a 
week before the run, teachers, administrators, and company employees all exhort the chil¬ 
dren daily to raise money—offering them individual and class prizes as incentives. Company 
employees disrupt classes and use class time to encourage children to solicit pledges, setting 
up a social environment and reward structure uncomfortable for students who cannot or 
do not want to participate. 61 They encourage children to hit up their relatives and everyone 
else they know for pledges. 62 They offer non-nutritious food (e.g., popsicles, ice cream, soda, 
and pizza), among other rewards, as prizes for classes who raise the most money. 63 Because 
they push the students to raise money from family and friends, Boosterthon and similar “fun 
run” companies may, if the school community is wealthy, raise a significant sum to be split 
between the school and the company. 64 If the community is not wealthy, less money is made 
and a larger percentage is taken by the company. 65 

Regardless of how much money they make, however, these fundraisers engage the entire 
school community to teach children a commercialized way of thinking about their world. 
When a PTA contracts with a fun run company, the company staff, teachers, administrators, 
and parents conspire to teach the children to focus purely on the money raised and the priz¬ 
es they can win for themselves. Fun run companies market their product as a fundraising 
tool, but the central aspect of their work is to bring all the players into alignment with the 
commercial values that validate their existence. That is, all the adults involved participate 
in manipulating the children to harass family and friends for contributions, to work for trin¬ 
kets, and most significantly, to learn that manipulation, harassing their family and friends, 
and working for trinkets are all desirable if they lead to getting the money in the end. Social 
pressures discourage objections. When Mr. Holmes tried to address these issues with a rep¬ 
resentative of his state’s PTA, the representative told him that “commercialism in schools is 
not an issue” for the state PTA. 66 


The Fallacy of “Partnership” 

Whether they acknowledge it or not, commercialism in schools is, indeed, an issue for par¬ 
ent groups, as it is for teachers, schools, and districts. More than ever, attention is a fun¬ 
gible commodity. Attention turns time into money. Those who can deliver attention in a 
hyper-cluttered ad environment, even if only for a few seconds, can charge mightily for it. 
TV networks charged $1.9 million for a 30-second commercial spot during the 2015 Oscar 
Awards, and $4.5 million during the Super Bowl. 67 Marketing in schools delivers children’s 
attention—and more—to the messages delivered by corporate sponsors. 

Corporations such as the National Football League, McDonald’s, and Boosterthon—and 
many others, including Verizon, Samsung, Nike, and Schwan’s 68 —structure an environment 
for educators, parents, and students in which it seems logical and commonsensical to ac¬ 
cept, and even seek, sponsorships and financial help. As the adults do just that, they teach 
children to do the same. 69 Legislators have come to expect it from them. 70 To these educa- 
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tion stakeholders, corporations present their efforts to capture children’s attention as help¬ 
ful “partnerships,” and they deny that such strategies constitute marketing, even when the 
money to fund them comes from marketing budgets. 71 

A 2003 Washington Post article explored the common-sense logic of corporate partner¬ 
ships and philanthropy when the National PTA both embraced Coca-Cola as a sponsor and 
archived its mass media resolution asserting that “marketing to children has no place in the 
classroom.” Then-PTA President Shirley Igo said about corporate sponsors, “We really need 
them. Our budget is very thin and if we didn’t have them, we wouldn’t be able to develop 
new programs.” She justified a PTA “partnership” with Coca-Cola to critics by claiming that 
it was adult- rather than child-focused and that the organization was “just partnering with 
Coca-Cola to encourage parent and community involvement.” 72 


In 2016, Igo’s logic is entrenched. Carol Hazen, former Director of Advocacy Resources at 
the University of Connecticut’s Rudd Center for Food Policy and Obesity, recounts being told 
by a National PTA leader that “marketing is not on its radar, and will not be until state PTAs 
start asking for it.” She adds, “Which they won’t—because they see it as a revenue stream.” 73 
When Frank Holmes objected to his state PTA posting a McDonald’s flyer advertising its 
school programs on the organization’s website, he was told that “all they [the state PTA] did 

_ . . was send it out for parents to peruse,” and 

For a corporation, a continuing 

“relationship” or “partnership” 

with a school, its stakeholders, and 

its students is more important— 


and over time, more lucrative— 
than any one school marketing 
program. 


“Whether they WANT to implement those 
McD programs or not is entirely up to the 
parents.” 74 What this means is that with its 
“contribution,” McDonald’s buys the orga¬ 
nizational leaders’ willingness to trade the 
attention of its member parents, who then 
may offer up the attention and participation 
of their children in exchange for money or 


a free program. As a result, everyone in¬ 
volved becomes accustomed to and comfortable with McDonald’s presence and influence 
in school—and even advocates for such relationships, seeing them as normal, natural, and 
beneficial. 


In October 2015, the National Education Association, the Campaign for Commercial-Free 
Childhood, Corporate Accountability International, and others demanded that McDonald’s 
stop holding McTeacher Nights. Their effort, covered widely in the media, pointed out the 
potential health consequences of having teachers promote fast food to their captive audience 
of students. 75 To the extent that parents, teachers, and administrators become more aware of 
the potential negative effects on children of allowing branded programs into schools and of 
their ability to challenge what has become custom, they and their organizations can further 
promote change. 

As McDonald’s, the NFL, and Boosterthon all know, however, “in marketing, it’s all about 
building relationships.” 76 For a corporation, a continuing “relationship” or “partnership” 
with a school, its stakeholders, and its students is more important—and over time, more lu¬ 
crative—than any one school marketing program. In marketing terms, relationships “foster 
customer loyalty, interaction and long-term engagement.” 77 In schools especially, they cre¬ 
ate an environment that welcomes corporations as contributing stakeholders in children’s 
education. This provides openings for ever more marketing, and it whittles away the concep¬ 
tion of schools as a public space outside the corporate sphere where children may develop 
values or visions for themselves, uninfluenced by consumer culture or corporate goals. 
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More than this, marketing programs that include a digital component hold children in a 
marketing environment, sometimes in a “program-length commercial” for the length of 
their school-initiated activity. 78 When we wrote about advergames in 2009 and 2010, we ex¬ 
pressed concern about marketing techniques, such as awarding children branded wallpapers 
and downloads, that keep them interacting with the brand both online and offline. 79 The re¬ 
cent evolution of digital marketing technology adds to those concerns: children’s school-ini¬ 
tiated online activity can enable behavioral tracking, data mining, and targeted marketing. 


Surveillance Culture at School 

As digital data-gathering capabilities have expanded, so too have commercializing activities 
in school, to push products and worldviews on children and increasingly to gather data about 
them. Any corporation that produces a branded app or website can incorporate technology 
to collect IP addresses and other information such as the pages, content or ads children see 
or click on, what they download, what games they play, information about a child’s device, 
operating system, and settings, and so on. The privacy policy for Scholastic products, for 
instance, describe such data collection. 80 

This type of data-gathering is mirrored and magnified by instructional and assessment prac¬ 
tices in classrooms that, in addition to whatever educational purpose they may serve, by their 
nature function as mechanisms of surveillance. In the context of an educational technology 
sector valued at over $8 million, the U.S. Department of Education encourages the use of 
massive data sets (known as “big data” 81 ) collected from students to facilitate technological 
innovation that promises to improve “deeper learning,” assessment, and support systems. 82 
Schools and districts collect, store, and report data on such things as attendance, tardiness, 
test scores and grades for state longitudinal data systems. Teachers record student behav¬ 
ior in classroom management applications, and use “adaptive learning” technologies, such 
as those marketed by Knewton and Pearson, that record student keystrokes, answers, and 
response times. 83 Jose Ferreira, the CEO of Knewton, said in a 2012 talk that, “Education 
happens to be, today, the world’s most data-mineable industry, by far.” 84 He claimed that his 
own product (which the company says is used for over 10 million students worldwide) col¬ 
lects five to ten million actionable data points per student per day: “We literally have more 
data about our students than any company has about anybody else about anything. And it’s 
not even close.” 85 

While such massive amounts of specific and personal data are being collected about children 
at school, there is little understanding of how that information may be used in the future, or 
how it may be used to manipulate children and cultivate them as current and future consum¬ 
ers. 86 Moreover, although a number of bills bearing on education privacy have been intro¬ 
duced in Congress and state legislatures, protection of student privacy to date is extremely 
limited. 87 


The Real Issues Regarding Privacy of Student Data 

Most of the laws protecting student data apply to the disclosure of personally identifiable 
information (PII). The voluntary Student Privacy Pledge, a self-regulatory project of the Fu¬ 
ture of Privacy Forum and the Software and Information Industry Association, also focuses 
on PII. 88 This focus does not, however, ensure that digital data will not be sold to advertisers, 
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nor does it prevent students’ online behavior from being tracked. 

Before we consider some ways that student data might end up in the hands of advertisers, it 
is useful to review three key federal laws related to the collection and use of student data in 
the United States. 


Federal and State Student Privacy Legislation 

Federal law addresses student privacy by means of the Family Educational Rights and Pri¬ 
vacy Act (“FERPA”; 20 U.S. Code § I232g), the Children’s Online Privacy Protection Act 
(COPPA; 15 U.S. Code Chapter 91), and the Protection of Pupil Rights Act (20 U.S. Code § 
I232h). 89 Although each of these laws provides protections to students, each also has dis¬ 
tinct weaknesses. 

FERPA, which applies to almost all public and private schools, provides the primary set of 
regulations governing student privacy in the U.S.. Any agency or institution that violates 
FERPA regulations loses eligibility for federal funds. However, FERPA’s scope is limited to 
“educational records”; the legislation does not protect such items as data collected by edu¬ 
cation websites or digital “pupil-generated content” (such as essays), unless PII is included 
in that information. 90 

Moreover, several FERPA exceptions allow student records to be disclosed to certain parties 
or under certain conditions without parental consent. The most significant exception is that 
without consent, school officials may release student records for any educational purpose 
they deem legitimate, as when an organizations is conducting studies for or on behalf of 
a school; records are also available to authorized representatives of the U.S. Comptroller 
General, U.S. Education Secretary, or state educational authorities. 91 

Changes to FERPA in 2008 and 2011 expanded the definitions of both school officials and 
authorized representatives. In one of the most important changes, the U.S. Department of 
Education now considers “school officials” to include “contractors, consultants, volunteers, 
and other parties to whom an educational agency or institution has outsourced institution¬ 
al services or functions it would otherwise use employees to perform.” 92 This change has 
far-reaching implications for student privacy. For example, when school leaders sign a con¬ 
tract to use Google Apps for Education (GAFE), they assign Google the authority of “school 
official.” 93 The Department also considers “authorized representatives” to be any individuals 
or entities that local or state educational authorities, U.S. Secretary of Education, or U.S. 
Comptroller General select as an authorized representative. 94 As a result of these changes, 
schools may now provide data to private companies without parental consent. 95 Significant¬ 
ly, these private companies are not named “partners,” but rather “school officials” or “au¬ 
thorized representatives.” 

The Children’s Online Privacy Protection Act (COPPA), which applies to children under the 
age of 13, requires companies to obtain parental consent before they can collect person¬ 
al information from children for commercial purposes. 96 In December 2012, the Federal 
Trade Commission (FTC) expanded several definitions under COPPA, increasing protection 
of children by accounting for new tracking technology. 97 While these changes are significant, 
the law does not apply to teens. Teens are especially at risk because they are online more 
than young children both in and out of school, and also because developmentally they are 
particularly susceptible to targeted marketing. 98 Although it may be impractical or impos- 
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sible to impose a parental approval requirement for teens’ online activity, teens’ personal 
information needs to be safeguarded as carefully as younger children’s. Jennifer Harris and 
her colleagues at the University of Connecticut’s Rudd Center for Food Policy and Obesity 
have argued, for example, that children need policy protections from unhealthy food mar¬ 
keting at least until the age of 14." 

When a school is using an educational application that involves collection of student data, an 
important question for districts is whether school personnel can provide consent to a com¬ 
pany on behalf of parents, or whether parents themselves must provide consent. If a vendor 
intends to use or share student information for commercial purposes unrelated to the school 
or district’s educational purposes, then COPPA requires direct parental consent. 100 

Finally, the Protection of Pupil Rights Act addresses consent in relation to the collection, 
disclosure, or use of personal student information for marketing purposes or as a product (a 
data set) for sale to others. 101 It allows schools and districts to participate in gathering stu¬ 
dent information for marketing purposes, but it requires them to tell parents they are doing 
so and to allow parents to view the data collection instruments and/or opt their children out. 


Proposed Federal Legislation, 114 th Congress (2015-2016) 

In the 2015-2016 legislative session, Congress introduced eight bills or amendments to bills 
related to student data (see Appendix A). 102 These included two amendments to the 2015 Ele¬ 
mentary and Secondary Education Act (ESEA) reauthorization. The first, House Amendment 
54, affirms the “sense of Congress” that Personally Identifying Information (PII) should be 
protected and shared outside of schools only with clear notice to parents; it also calls for the 
Secretary of Education to review student privacy regulations to ensure that PII is protect¬ 
ed. 103 Senate Amendment 2080 proposes establishing a Student Privacy Policy Committee 
to study the regulatory framework and make recommendations. 104 While House Amendment 
54 has become part of enacted legislation, Senate Amendment 2080 has not left committee. 

Other legislation introduced attempts to: increase transparency regarding what type of data 
companies collect or generate, how data is used, and whether it is shared; increase parental 
rights with respect to their children’s data; and, implement privacy and security protection 
requirements for third-party companies with access to student data. Importantly, the bills 
prohibit the commercial use of student data—but they also contain significant loopholes. For 
example, language that specifies that a bill does not “limit the ability of an operator to use 
information, including covered information, for adaptive or personalized student learning 
purposes” allows providers to track students, since tracking can be considered an aspect of 
personalizing student learning. However, with that educational purpose met, data can likely 
also inform further software development and possibly other commercial uses. 105 These bills 
remain in committee and are unlikely to be enacted, despite pressure from educators and 
children’s advocates for the federal government to take the lead on effective regulation of 
student data and protection of student privacy. 106 


State Legislation 

In our 2014 report on schoolhouse commercializing trends, we reviewed state laws passed 
between 2011-2014 and noted that the overwhelming majority of them applied only to edu¬ 
cational record data, and within those records, to personally identifiable information (PII). 
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Many state laws simply require schools and districts to make parents aware of their rights 
under FERPA without offering additional protections. Few states offer parents the right to 
correct their children’s data, require specification of how data will be used, 107 require de¬ 
struction of the data collected, 108 or explicitly prohibit the use of data for commercial pur¬ 
poses. 109 In 2015 and 2016, state legislatures introduced numerous bills addressing student 
privacy (182 in 2015 and 94 in 2016), but enacted few of them (16 in 2015 and 6 in 2016). 110 

California laws currently provide the strongest student privacy protections, particularly in 
California Business and Professions Code §§22584-22585, the Student Online Personal In¬ 
formation Protection Act (SOPIPA). This act regulates Internet sites, online services, online 
applications, and mobile applications designed and marketed for K-12 school purposes. 111 It 
prohibits operators of such services from engaging in targeted advertising, from collecting 
information to create profiles of K-12 students (except as needed to meet the education 
purposes for which it was contracted), and from selling or disclosing students’ information. 

SOPIPA, the strongest privacy legislation in the United States, does not apply to “general 
audience Internet Web sites, general audience online services, general audience online ap¬ 
plications, or general audience mobile applications.” 112 This means that, as described below, 
it does not apply to Google applications that are not explicitly part of the Google Apps for 
Education (GAFE) suite. SOPIPA may also allow Google to collect students’ browsing data 
from their school-assigned Chromebooks. 113 


Self-Regulation by Industry: Guidelines, Hazy Promises and Dodgy Behavior 

Industry and education professionals emphasize limiting data collection and sharing, and 
anonymizing students’ data whenever possible. 114 The Consortium for School Networking 
(CoSN), a professional association for district technology leaders, calls for students’ per¬ 
sonal information to be shared under terms or agreements only “with service providers for 
legitimate educational purposes,” and for schools and their contracted service providers 
to have “clear, publicly available rules and guidelines for how they collect, use, safeguard, 
and destroy those data.” 115 These are important guidelines, but vague in how they may be 
implemented, especially when product development is considered a “legitimate educational 
purpose.” 116 

In 2014, shortly after California passed its student privacy legislation, the Future of Priva¬ 
cy Forum (FPF) and the Software & Information Industry Association (SIIA) spearheaded 
the Student Privacy Pledge, stating similar goals. 117 As of May 9, 2016, 268 companies have 
signed onto the pledge. 118 Although it contains significant protections, the pledge is far from 
airtight. 

Pledge signatories promise to refrain from: collecting, maintaining, using or sharing student 
personal information beyond that immediately needed for the contracted educational pur¬ 
poses; selling student information; using or disclosing student information for the purpose 
of developing behavioral targeting for advertisements to students; knowingly retaining stu¬ 
dent personal information beyond the time necessary to complete contracts; and changing 
without notice their privacy policies or other policies regarding the use of student personal 
information. 119 Signatories also promise to: limit data collection to that needed for contract¬ 
ed purpose; disclose clearly in an easy-to-understand manner the nature of data collected 
about students and why it may be shared with third parties; support parent access to and 
correction of student personally identifiable information; protect the security of the data 
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collected; and make sure, in the event of an acquisition of the company, that its successor 
commits to the same safeguards. 120 

Loopholes are, however, numerous. The pledge: allows companies to use student data for 
their own purposes in product development; does not require companies to inform or obtain 
consent from parents before they collect sensitive data from their children’s use of the edu¬ 
cational software; does not specify where parents can learn about company data policies and 
if or how they can opt their children out; and does not contain enforcement mechanisms. 121 

A 2014 Politico article cited legal scholar Joel Reidenberg as noting that “the strength of the 
commitment [of pledge signatories] will be subject to how certain key terms are understood 
and interpreted by the companies.” 122 Since 2014, several examples have clarified differ¬ 
ences between companies, on one hand, and parents and privacy advocates, on the other, in 
their understanding of those terms. 

Tony Porterfield, a California software engineer, found potential security flaws in several 
popular apps his children use in school. 123 In February and again in March, 2015, he found 
holes in the security of the Raz-Kids/LearningA-Z online reading instruction application. 124 
Raz-Kids’s parent company, Cambium Learning Group, had previously signed onto the Stu¬ 
dent Privacy Pledge, and its CEO told the New York Times in February 2015, “We are con¬ 
fident that we have taken the necessary steps to protect all student and teacher data at all 
times and comply with all federal and state laws.” 125 

There is no accountability structure associated with the Student Privacy Pledge. Individuals 
can file a complaint with the Federal Trade Commission (FTC) that a signatory to the pledge 
has violated it, and has thereby engaged in “deceptive practice.” An individual could file the 
same kind of complaint if a company—signatory or not—violates its stated privacy policy. 

It seems unlikely that parents would file a complaint with the FTC about a company’s non- 
compliance, and unlikely that the FTC would have the capacity or interest to consider a com¬ 
plaint about a voluntary industry-led pledge. 126 Khaliah Barnes, Director of the Electronic 
Privacy Information Center’s (EPIC) Student Privacy Project, notes that that although the 
FTC has enforcement powers, it “has been reluctant to bring enforcement actions with re¬ 
spect to student privacy.” The Commission has not yet responded to education privacy-relat¬ 
ed complaints, for example, that EPIC filed as long ago as 2013. 127 For this reason EPIC, as 
well as the Parent Coalition for Student Privacy and other privacy advocates, are calling for 
enforceable legislation providing parents with private right of action. 128 Meanwhile, school 
district lawyers can provide a back-stop by carefully evaluating contracts with education 
technology providers and demanding terms that exceed current legally required minimum 
protections. Fordham University’s Center on Law and Information Policy has recommended 
that districts establish data governance advisory councils and that larger districts designate 
a Chief Privacy Officer to oversee data governance. 129 


Google and Facebook Track Students 

In addition to promoting self-regulation, companies that supply “big data” spend millions of 
dollars to influence lawmaking and keep regulation at bay. In 2013, Advertising Age noted 
that Google and Facebook, “two of the most pervasive digital-data collectors,” significantly 
increased their lobbying expenditures between 2011 and 2012—to $19.6 million for Google 
and $4.6 million for Facebook in 2012. 130 Google and Facebook are both widely used by 
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schools. 

According to one Google blog post, it reaches “more than 30 million students, teachers and 
administrators globally” via its Google Apps for Education (GAFE). 131 In December 2015, 
the Electronic Frontier Foundation submitted a complaint to the Federal Trade Commission 
(FTC) accusing Google of tracking students signed into their GAFE accounts when those 
students navigate to Google-owned general use sites not specifically included in the GAFE 
suite of services (such as Google Search, Books, News, Maps, and YouTube), and tying those 
tracking data to the students’ GAFE accounts. 132 

This complaint highlights the problems with the Student Privacy Pledge that Google signed 
in January 2015. According to lawyers for EFF, Google argues that the pledge does not apply 
to general audience websites, so if a student is logged into his GAFE account and travels 
outside the specific educational sites included in that package to general audience websites 
(including those owned by Google) the pledge does not apply. Google believes it is following 
the pledge. If the FTC decides that it is, say the lawyers, the pledge has no teeth. 133 They 
argue that Google gets students’ PII through GAFE, and therefore should not connect it to 
tracking data obtained from non-GAFE sites. 

Facebook, which officially creates accounts only for users over the age of 12, does not dis¬ 
tinguish between students and non-students in its tracking activity. Unbeknownst to most 
users, since 2011 Facebook has tracked whenever its users browse to any page housing a 
“like” button. 134 Beginning in 2015, it not only records this browsing data, but also uses it in 
its ad targeting systems. In other words, when people who have Facebook accounts browse 
to a page that has a like button (regardless of whether they happen to be logged into their 
accounts), their visit to that page could be used to determine the ads fed to them in Facebook 
proper, in other apps that Facebook owns (such as Instagram), and in other mobile appli¬ 
cations that use Facebook’s ad network. 135 Even if users take up Facebook’s offer to opt out 
of receiving interest-based ads, Facebook continues to track their browsing behavior. EFF’s 
Nate Cardozo interprets this as meaning that, “Facebook doesn’t allow us to opt out of being 
tracked all over the Internet; it merely allows us to hide that fact from ourselves.” 136 

Google and Facebook may be the largest companies to collect and use data in legal but ques¬ 
tionable ways, but they are likely not the only ones. 137 


The Myth of Anonymous Data 

Data anonymization (or “de-identification”) is promoted by the industry as the solution to 
concerns about tracking. 138 Even if companies anonymize student data for security or mar¬ 
keting purposes, however, students’ personally identifiable information (PII) may not be 
fully or permanently protected. From only a few data points, de-identified data can be easily 
re-identified. 139 In 2008, Narayanan and Shmatikov demonstrated the re-identification of 
anonymous Netflix movie raters with a model that revealed those raters’ apparent political 
preferences and other potentially sensitive information. 140 They pointed out that their model 
could be applied to any dataset containing “anonymous multi-dimensional records, such as 
individual transactions, preferences”—or student information. 

Moreover, even with only anonymized behavioral tracking data, marketers can target a given 
computer’s user with advertisements and other communications geared specifically to ap¬ 
peal to and influence that user. EFF’s complaint about Google’s tracking of students centers 
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on the company tying the behavioral data it tracks to the identified GAFE accounts; but 
when the child is the primary or only user of the device (as is certainly the case when that 
device is a school-assigned Chromebook, for instance), 141 targeted advertising does not re¬ 
quire identification at all. 

This being the case, the editor of the trade publication Advertising Age, Ken Wheaton, 
bluntly called data anonymization “a load of horseshit... a clever bit of technical and verbal 
misdirection used by marketers and tech people to keep regulators at bay.” 142 In no way, 
he claims, does data anonymization actually make people or their data anonymous. This is 
because, armed with a rich set of anonymized data, “You might not know my name (but you 
probably do), but that hardly matters if you know every move I make, every breath I take.” 143 

Wheaton also notes marketers’ interest in federal law to address data security, and sees in 
that a cynical attempt to: (l) distract lawmakers from addressing the issue of data brokering 
(2) limit marketers’ liability “when their supposedly secure servers get hacked”; and (3) ne¬ 
gate laws such as SOPIPA that try to hold them accountable. 144 


Understanding How Tracking May Influence Children 

In prior annual reports on schoolhouse commercialism, we pointed out that although much 
online advertising to children takes place outside the school, schools serve as a portal to and 
reinforcer of digital marketing media and messages. 145 Let’s follow a student to see how this 
might happen. 

Maddie, a high school student, spends a lot of time on the computer both recreationally and 
for school. 146 With respect to her schoolwork, she says, “Some days it can be hours. I feel 
like a lot of the stuff is through online documents and things. If I’m not reading a book, for 
example, I’m working on a presentation for it.” She says that classes that require projects 
and essays, rather than her math and science classes, are the ones that put her online most. 

When she works online, she also spends time on sites other than those she happens to be 
using for her schoolwork: “I’ll surf . . . open a new tab and go to Twitter, or Facebook, or 
Buzzfeed. Also Yahoo and Netflix. It’s all so accessible. I’m watching 30 Rock. Each episode 
is 20 minutes, which is a good break. I get my texts on my computer, so I see them.” 

Of the various applications she uses for school, Maddie is most excited about GAFE (“You 
don’t have to worry about uploading, downloading, saving. You can use it from anywhere— 
home, wherever—and it’s great for group projects.”). She uses it mostly to turn in assign¬ 
ments and to work on group projects and create presentations. 

She uses other applications as well. She complains that different teachers require the students 
to use different applications for submitting homework: sometimes turnitin.com, sometimes 
Edmodo. Her psychology and science classes use domain-specific education technology ap¬ 
plications (Psych Sim 5 and Gizmos, respectively) for activities and online experiments. Her 
teachers rarely take her classes to the school’s outdated computer lab (“Maybe 10-15 times 
the whole year, but it was so annoying that I remember it.”); instead, they often ask the stu¬ 
dents to log in using their personal cell phones. 

For school-related but non-class activities, Maddie uses Sparknotes to help with reading and 
Facebook to participate in student groups with which she is associated: the International 
Baccalaureate program, a volunteer group, the senior class, the school “pep” group, and the 
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National Honor Society. She must also use a variety of sites tied to the college admissions 
process: Naviance for college planning, the Common App for applications, Parchment to 
send transcripts, and the College Board for SATs and AP tests. When she created a profile 
with the College Board, Maddie probably checked the box that said she wanted to receive in¬ 
formation from colleges or scholarship organizations (65-85 percent of students do), there¬ 
by providing her consent to the College Board to market her profile. 147 

In a typical day, then, Maddie is on her phone and computer on and off throughout the day 
and into the evening, switching between school and personal use. She has noticed that her 
computer “knows” what she wants to buy, and feeds her ads accordingly. Once when she had 
been looking at shoes, she mentioned, an ad for shoes appeared in the middle of a Spark- 
notes chapter summary. 

Maddie is neither unusual nor extreme in her use of technology. Her school does not engage 
in cutting-edge data collection, nor does it have a “l-to-i” program that would put her online 
during many more of her classes. 148 Even without those, her schoolwork puts her online for 
much of her day, where she seamlessly transitions between school-assigned and commercial 
websites. 

How might this affect her? It starts with Maddie preparing an assignment for a class, let’s 
say a presentation on Night, which she read for her ninth-grade English class. As she moves 

in and out of the protected applications that are part 
of the GAFE suite, marketing companies quietly but 
persistently track her activity. Accompanied by an ap¬ 
plication that identifies tracking, we surfed through a 
couple of sites that Maddie might visit while working 
on her presentation; we found 16 companies track¬ 
ing us from dictionary.com and over 35 from Spark- 
notes. 149 With the information they collect about her, 
these companies—or other companies to whom they 
sell her data—determine what kinds of ads Maddie might respond to, and serve them to her 
on those sites and on others she visits. 

We have all had the experience like the one that Maddie remembers of looking up shoes 
online and then seeing many shoe advertisements and eerily relevant Facebook “sponsored 
content” pop up in the following days and weeks. And if we succumb to the temptation and 
click on one, it prolongs and increases the effect. Shoes, clothes, make-up, more clothes .... 
The ads may sprout from Maddie’s initial interest, but from there they proliferate, repeated¬ 
ly and gently nudging her to think, like, buy, and talk about the products they promote, and 
to adopt the underlying perspective of consumer culture, that products can make her happy. 

The problem is not that ads do this once, twice, or even twenty times. It is that they do it 
repeatedly from the time Maddie first starts using the Internet, that the potential effects 
build on themselves, and that Maddie’s schoolwork introduces her to and holds her in this 
environment that consistently presents her with marketing directed specifically to appeal 
to her. A developing adolescent, her interests, attitudes, and anxieties are shaped carefully 
over time by repeated exposure in this commercial womb that surrounds her with products 
and ideas designed to lead not to her healthy development, but rather to purchase. 150 

At a panel discussion at February 2016’s Mobile World Congress, Roi Carthy, the Chief Mar¬ 
keting Officer of ad-blocking company Shine, graphically emphasized the reach and power 
of Internet marketing: “Every individual using a mobile handset, smartphone or desktop 
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As she moves in and out of 
the protected applications 
that are part of the GAFE 
suite, marketing companies 
quietly but persistently 
track her activity. 



is being abused by ad-tech—that’s not selective, that is too percent.” He continued, “We’re 
talking about military-grade tracking, targeting and profiling.” 151 “Big data,” which is in¬ 
visibly collected on children via what is essentially constant surveillance of their digital 
behavior, provides much greater depth of information about them than “old-fashioned,” 
low-tech profiling and targeting. In other words, data gathering and surveillance are now 
merged. Metadata can now be analyzed using computational techniques that allow market¬ 
ers to model specific individuals rather than aggregated groups, to test the accuracy of those 
models in real time with the individuals in question, and to adapt them accordingly for more 
effective use. 152 

Although companies that collect, sell, analyze, and buy data may not know children’s names 
(though they probably do), that hardly matters if they have the information and tools nec¬ 
essary to model everything about those children—including their interests, social networks, 
personalities, vulnerabilities, desires, and aspirations—and if they have personalized access 
to children, via their electronic devices, to shape them. 153 By feeding children ads and other 
content personalized to appeal specifically to them, and also by choosing what not to show 
them, marketers influence children’s thoughts, feelings and behaviors. 154 As they do, they 
also test, adjust, and perfect their models of influence—and then track and target some 
more. 155 


How Big Data Practices Amplify Threats to Children’s Physical and Psychologi¬ 
cal Well-Being 

Food products are not only the most marketed products to children in school, but they are 
also highly marketed products to children online. 156 The food industry leads the way in de¬ 
veloping techniques to market its products to children, particularly foods high in fat and 
sugar and low in nutrition, which lead to obesity, metabolic syndrome, and other illness¬ 
es. The threats that over-consumption of such foods pose to children’s health also include 
higher cholesterol levels and blood pressure, greater incidence of type 2 diabetes, coronary 
plaque formation, several types of cancer, bone and joint problems, sleep apnea, gout, gall¬ 
stones, and a shorter life expectancy. 157 Additional medical implications continue to be re¬ 
vealed; for example, type 2 diabetes progresses more rapidly in obese children than it does 
in adults, and typical treatment fails to slow it. 158 Consequently, obese children are at risk for 
such complications as heart disease, eye problems, nerve damage, amputations, and kidney 
failure much earlier in life than people who become diabetic as adults. 159 

In addition to threatening their physical well-being, marketing disposes children to a variety 
of psychological ills: heightened insecurity about themselves and their place in the social 
world, displacement of values and activities other than those consistent with materialism, 
and distorted gender socialization. 160 Especially for adolescents, who are even more likely 
than younger children to be online as part of their schoolwork, marketing exploits psycho¬ 
logical vulnerabilities—in particular, their reduced ability to control impulsive behaviors 
and to resist immediate gratification—and capitalizes on their susceptibility to peer influ¬ 
ence and image advertising. Because of its specificity and omnipresence, targeted digital 
marketing to children, like “consumer culture on steroids,” amplifies these threats. 
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Heightened insecurity 

Through their immersion in consumer culture, children internalize the ideals of that cul¬ 
ture: the “good life” and the “body perfect.” 161 Psychologist Helga Dittmar points out that 
consumer culture creates vulnerability in children by causing them to feel far away from 
the ideals they adopt from consumer culture, and to feel bad about this gap. It then exploits 
the vulnerability it created by presenting solutions (products) that purportedly can repair 
children’s identity deficits and negative emotions—which, of course, they cannot. Dittmar’s 
research supports her contention that when their lives do not match up to the ideals fed to 
them by toys, television shows, music videos, and advertisements, children become insecure 
about their bodies and their very selves. 162 Girls as young as five years old, for example, 
report wanting a thinner body. 163 Other effects are dissatisfaction, low self-esteem, eating 
disorders, and compulsive shopping. 164 


Displacement of values and activities 

Consumer culture pre-empts development of other interests that may be more functional. 
Psychologist Allen Kanner notes that the more that people believe they need material goods 
to be happy, the more time, effort, and thought they put into finding and acquiring those 
goods—and the less time they have for other activities such as spending time with family and 
friends, engaging in spiritual practices, playing, or creating. 165 

This displacement may be especially serious for children, for whom the development of rela¬ 
tionship-building skills and creative thinking may be sacrificed when consumer-oriented ac¬ 
tivity pushes out the time for unstructured, child-directed creative play. 166 Consumer culture 
packs a “double whammy” for children: not only may it make them unhappy by highlighting 
their distance from an idealized life and body as noted above, but it may also prevent them 
from cultivating interests and practices that would distract from, or counteract, their un¬ 
happiness. This possibility is consistent with correlations found between higher material¬ 
istic values and higher rates of anxiety, depression, psychological distress, chronic physical 
symptoms, and lower self-esteem. 167 In teenagers, higher materialistic values also correlate 
with increased smoking, drinking, drug use, weapon carrying, vandalism, and truancy. 168 


Distorted gender socialization 

Consumer culture in general, and marketing and advertising specifically, present children 
with highly gendered images that tell them, implicitly, what they are and should be like. 
Advertising sells children a hypersexualized norm at a time when they are negotiating their 
own identities. 169 From advertising, children learn that women are dependent, passive, sex¬ 
ual objects. 170 They learn that men pursue excitement and sensation, show little emotion or 
empathy, especially with regard to sex, and are physically violent. 171 Unconsciously, chil¬ 
dren absorb these messages, which influence their self-concepts. Videogames such as Grand 
Theft Auto, Halo, and Call of Duty, particularly popular with boys, are hypersexualized and 
violent—as are advertisements for these games. 172 

Although most of the ads that children see present hypersexualized characters as the norm, 
the problem is magnified with targeted marketing, because with targeted marketing the ads 
presented to boys and girls are different. Whereas girls like Maddie are repeatedly reminded 
of the importance of clothing and their appearance, boys are pushed in other directions—for 
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instance, toward sports and videogames, where violence, excitement, and emotional aloof¬ 
ness are the norm. Over time, these differences lead girls and boys to see a different set of 
stimuli. 

Although it is not new that girls’ and boys’ play, conversation, and activities differ, targeted 
marketing discreetly amplifies and exploits those differences. 173 If Maddie and her friend 
Sean get together to collaborate on a presentation for their English class, for example, they 
may work side by side on their individual computers, each flipping to Facebook and You¬ 
Tube when they need a break. Even in the same room, they would view different advertise¬ 
ments and not realize that the other is being served a different set of implicit messages about 
sex and gender roles. Both Maddie and Sean would deny that they are influenced by the ads 
they see, but research finds that they are, in fact, affected. 174 

An important part of the problem of policymaking related to advertising and marketing is 
that people routinely deny its impact on them. Although it is hard for people to recognize 
marketing’s influence on their behavior, research suggests both that marketing influences 
people and that people are not reliable judges of that influence. 175 When students and the 
stakeholders who care about them discount marketing’s effects, it becomes logical for all 
involved to accept advertising and marketing in schools as a reasonable trade-off for the 
“help” offered by corporations. 


Socializing Children to Accept Digital Surveillance as Normal 

Advances in digital technology have provided marketers the opportunity to build relation¬ 
ships with consumers as never before. Marketers collect, analyze, and use data to target 
consumers with increasingly precise messages to promote their brands. The trick, however, 
is getting the data—and therein lies the genius of Internet business models. The Internet 
provides seemingly endless free content and services to entice consumers, including chil¬ 
dren, to eagerly interact with the technology and leave their trail of information behind. But 
marketers have faced, and have worked steadily and successfully to overcome, some limits: 
their problem has been that children spend many of their days in school, and at home par¬ 
ents have hesitated to allow them to spend large portions of their free time online. Market¬ 
ers’ goal has been to increase children’s interaction with technology, to make it a valid part 
of their lives all the time—to create a situation that compels them to interact with it for their 
schoolwork and homework even as more and more games and other services entice them to 
spend recreational time online. The proliferation of education technology software and gen¬ 
eral applications that can be used in education settings is, no doubt, at least in part fueled 
by the need to push boundaries. 

Schools have proven to be a soft target for data gathering and marketing. Not only are they 
eager to adopt technology that promises better learning, but their lack of resources makes 
them susceptible to offers of free technology, free programs and activities, free educational 
materials, and help with fundraising. Schools are under relentless pressure to make ever 
greater use of technology. Our techno-friendly Zeitgeist embraces and celebrates the rapid 
proliferation of education technology in every corner of our lives. In school, teachers are 
encouraged to integrate technology into their lessons and homework, and to rely on comput¬ 
erized student performance data as a diagnostic tool. State and federal laws now require that 
schools do extensive data reporting; in addition, the Common Core testing regime requires 
students to take computerized tests—and therefore to be computer-competent before they 
approach the tests. 176 
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Although some parents continue to resist the collection and use of their children’s data, 177 
other factors smooth the way for data gatherers: Many parents’ qualms are softened by the 
apparent safeguards protecting personally identifiable information (PII) that legislation and 
industry self-regulation provide. Stakeholders, including children, are learning to accept 
the idea that constant data gathering and attendant surveillance of children is necessary to 
provide them with desirable educational and financial benefits. Most of us are thrilled by the 
convenience of computers that seem to know exactly what we want and offer it to us. When 
a website helps us with a search or offers us the best deal on a product we want to buy, we 
usually don’t stop to consider what information is being collected to enable that help, who 
is collecting the information, or how else it is being used. Long paragraphs of legalese deter 
us from exploring the privacy disclosures we must agree to in order to access the service. We 
are, thus, to some extent being socialized to ignore and tacitly accept the collection, organi¬ 
zation, and sale of information about us. 178 

All children, including teens, are more susceptible than adults to having their affinities 
shaped by marketers exploiting their vulnerabilities. Because they believe that what their 
schools do and parents allow is in their best interest, children are growing up experiencing 
constant surveillance as a norm to be accepted and even welcomed into their academic and 
social lives, as it brings them both what they need and what they want from the Internet. 


Conclusion 

In 2014-2015, digital marketing continued expanding—especially through schools. Corpo¬ 
rations use the medium to nurture relationships that entrench their influence, with repeat 
exposures cultivating more favorable dispositions toward commercial brands, products and 
worldviews. Tracked on their devices, children are plied with marketing that stems from 
their school-assigned activity and from where they wander on their breaks from studying. It 
is not in children’s interest, but it is in the interest of everyone who has something to sell, 
for students to spend as much time online as possible. 

The overt commercialization of schools as described in the first section of this report, and 
the surveillance practices described in the second, both exploit the now chronic underfund¬ 
ing of American public schools—especially in a policy context that requires districts to invest 
more in testing and accountability and less in teacher salaries, instructional materials, and 
other educational resources. 179 Chronic underfunding: creates openings for free sponsored 
educational materials to take the place of books and libraries; helps parents be comfort¬ 
able with such things as Nike-sponsored running clubs and NFL-sponsored sports days; and 
helps all stakeholders welcome and expect parent groups to work with corporate “partners” 
to bring needed funds to their schools. 

While education technologies show great promise, they also hold the potential to harm stu¬ 
dents profoundly if they are not properly managed to ensure that they serve students’ best 
interests. 180 Although it is unrealistic to expect schools to reverse the trend toward the use 
of educational software, Internet websites, and mobile applications, it is not unrealistic to 
protect children from the potential dangers of digital marketing. Ideally, children will be 
protected at all levels: by the parents, teachers, and administrators who serve as the most 
proximal gatekeepers of commercial activity and protectors of their privacy at their schools, 
and by the state and federal legislators responsible for enacting relevant policy. 
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Recommendations 

It is recommended that: 

1. Parents, teachers, and administrators—as individuals and through their organiza¬ 
tions—work to make public the threats that branded programs and materials, as 
well as unregulated digital technologies, pose to children when they are allowed 
into schools and classrooms. 

2. The Federal Trade Commission extend the Children’s Online Privacy Protection 
Act (COPPA) protections to age 14 and strengthen the protections offered to ado¬ 
lescents ages 15-18. 181 

3. Industry self-regulation not be relied upon to protect the interests of students. In¬ 
stead, policymakers should adopt enforceable legislation that holds schools, dis¬ 
tricts, and companies with access to student data accountable for violations of stu¬ 
dent privacy. 

4. Legislators carefully review proposed legislative language to insure that it does not 
contain loopholes that provide companies with opportunities to collect and exploit 
children’s data while also “following the letter of the law.” 

5. Those designing and reviewing relevant policies ensure that policies protect the 
privacy not only of student educational records but also of the wide variety of stu¬ 
dent data (including anonymized data) now being collected and shared. Such pol¬ 
icies should explicitly address the potential commercial use of any data collected. 

6. School district and privacy specialists review contracts with educational technology 
and other providers to check specifically for provisions or omissions that enable 
third parties to monitor and/or exploit students for commercial gain. 

7. Policymakers at every level seek to eliminate perverse incentives that encourage 
parents, teachers, and administrators to sacrifice student privacy in an effort to 
financially support educationally necessary school activities. 
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Appendix A 

Comparison of 2015 Federal Education Data Privacy Bills 

The National Association of State Boards of Education’s (NASBE’s) analysis of pro¬ 
posed federal education data privacy bills. 1 


NAS BE 

National Association of 


Comparison of 2015 
Federal Education Data Privacy Bills 

Updated 7/22/2015 


BILLS THAT PRIMARILY REGULATE SCHOOLS & LOCAL AND STATE EDUCATION flILLS THAT p RIMARILY REGULATE THIRD PARTY COMPANIES 










The SAFE KIDS 



KEY 

INFORMATION 

The Family 
Educational 
Rights and 
Privacy Act of 
1974 (FERPA) 

(as it exists today) 

The Student 
Privacy 
Protection Act 
(FERPA Re- 
Write) 

(Representatives 
Rokita, Fudge, 
Kline, & Scott) 

Protecting 
Student Privacy 
Act 

(Senators Markey 
& Hatch) 
S.1322.IS 

Student Privacy 
Protection Act 

(Senator Vitter) 

S. 1341 .IS 

Elementary and 
Secondary 
Education Act 
(ESEA)of 1965- 
Amendment 
(Representative 
Hurd) 

H.R. 5 

The Student 
Digital Privacy 
and Parental 
Rights Act of 
2015 

(Representatives 
Polis & Messer) 
H.R. 2092.IH 

The Children's 
Online Privacy 
Protection Act of 
1998 (COPPA) 

(as it exists today) 

Act 

(Safeguarding 
American 
Families from 
Exposure by 
Keeping 
Information and 
Data Secure) 

(Senators 
Blumenthal & 

Do Not Track 

Kids Act of 2015 
(COPPA 
Amendment Act) 

(Senator Markey; 
Representative 
Barton) 

H.R. 2734 

ESEA 

Amendment 

(Senators Markey 
& Hatch) 

S. 1177 


Status: 


Daines) 


Passed in 1974, 
amended 
numerous times 
by legislative 

Bill introduced 

Bill introduced 

Bill introduced 

action and 

July 22, 2015. 

May 13,2015. 

May 14, 2015. 

Department of 
Education 
regulations. 





Amendment 
passed July 10, 
2015. 


Bill introduced 
April 29, 2015. 


Passed in 1988 
and effective in 
2000, with the 
FTC empowered 
to amend through 
rulemaking. 


Bill introduced 
July 16, 2015. 


Bill introduced 
June 11,2015. 


Amendment 
introduced July 7, 
2015. 


www.nasbe.org 


Source: National Association of State Boards of Education 182 

l This table primarily reports objective information about the 2015 federal student privacy bills. In two places, 
however, it evaluates the bills’ provisions for consistency with NASBE’s perspective on the proper balance 
between privacy and the use of technology in schools (i.e., the rows entitled “Strikes a good balance between 
protecting privacy and enabling valuable data and technology use” and “Acknowledges the importance of data for 
personalized learning”). We do not agree with NASBE’s perspective. We recommend against legislative language 
that explicitly removes barriers to “the ability of an operator to use information, including covered information, 
for adaptive or personalized student learning purposes,” as do The Student Digital Privacy and Parental Rights 
Act of 2015 and the SAFE KIDS Act. Such language substantially weakens the privacy protections the bills 
otherwise afford. 
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KEY 

INFORMATION 


The Family 
Educational Rights 
and Privacy Act of 
1974 (FERPA) 

(as it exists today) 


FERPA Discussion 
Draft 

(Representatives 
Kline & Scott) 


Protecting Student 
Privacy Act 

(Senators Markey & 
Hatch) 
S.1322.IS 


Student Privacy 
Protection Act 

(Senator Vitter) 
S.1341.IS 


Elementary and 
Secondary 
Education Act 
(ESEA) of 1965- 
Amendment 
(Representative 
Hurd) 

H.R. 5 


The Student 
Digital Privacy and 
Parental Rights 
Act of 2015 

(Representatives 
Polis & Messer) 
H.R. 2092.IH 


The Children's 
Online Privacy 
Protection Act of 
1998 (COPPA) 

(as is exists today) 


The SAFE KIDS 
Act 

(Senators 
Blumenthal & 
Daines) 


Do Not Track Kids 
Act of 2015 
(COPPA 
Amendment Act) 

(Senator Markey; 
Representative 
Barton) 

H.R. 2734 


ESEA Amendment 

(Senators Markey & 
Hatch) 
S.1177 


Bottom Line: 

FERPA 
establishes 
parental rights to 
access, 

amendment, and 
control over the 
use and disclosure 
of student data. 

Rewrites FERPA 
to be clearer, to 
codify some of its 
regulations, and 
introduces privacy 
provisions 
requiring greater 
transparency, 
clear restrictions 
on data collection 
and use, and 
clarifications to 
keep FERPA 
current with 
evolving 
technologies. 

Proposes to 
amend FERPA by 
establishing new 
data security 
standards, 
restricting how 
companies can 
use student data, 
and granting 
greater access to 
and transparency 
of data. 

Seeks to update 
FERPA by 
establishing new 
restrictions on the 
collection, use, 
and sharing of 
student records, 
focusing on 
parental notice 
and consent. 

Incorporates 
Congressional 
findings that 
student PII: should 
be protected and 
should be shared 
outside of schools 
only with clear 
notice to parents. 
Additionally finds 
that the Secretary 
of Education has 
the responsibility 
to ensure 
compliance, and 
that Congress 
should review all 
student privacy 
laws to protect 
student PII. 

Seeks to regulate 
online service 
providers to 
balance classroom 
innovation with 
need for improved 
data security. 

COPPA regulates 
online service 
providers that 
direct their 
products to 
children from 
knowingly 
collecting 
personal 

information from 
children without 
satisfying certain 
notice 

requirements. 

Regulates online 
service providers 
to implement 
privacy 
protections for 
student data 
privacy. 

Amends the 

Children’s Online 
Privacy Protection 
Act of 1998 
(COPPA) to 
update privacy 
protections for 
children’s use of 
online services. 

Establishes the 
Student Privacy 
Policy Committee, 
which will consist 
of no more than 

20 members 
appointed by the 
Secretary of 
Education, the 
Comptroller 
General, and the 
majority and 
minority leaders 
of both houses. 
The Committee 
will study and 
make 

recommendations. 

This bill 
targets: 

Primarily targets 
educational 
agencies and 
institutions but 
also impacts 
online service 
providers 

Primarily targets 
educational 
agencies and 
institutions but 
also impacts 
online service 
providers. 

Primarily targets 
educational 
agencies and 
institutions but 
also impacts 
online service 
providers 

Primarily targets 
educational 
agencies and 
institutions but 
also impacts 
online service 
providers 

Congress, the 
Secretary of 
Education, and 
schools. 

Online service 
providers 
(primarily ed tech 
companies and 
non-profits) 

Online service 
providers 
directing products 
at children 

Online service 
providers 
(primarily ed tech 
companies and 
non-profits) 

Any operator 
providing a 
service directed at 
children or that 
has knowledge 
that the service 
collects personal 
information from 
children 

Reviews entire 
regulatory 
framework, 
including how to 
improve 
coordination 
between federal 

and state laws. 
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KEY 

INFORMATION 


The Family 
Educational Rights 
and Privacy Act of 
1974 (FERPA) 

(as it exists today) 


FERPA Discussion 
Draft 

(Representatives 
Kline & Scott) 


Protecting Student 
Privacy Act 

(Senators Markey & 
Hatch) 
S.1322.IS 


Student Privacy 
Protection Act 

(Senator Vitter) 
S.1341.IS 


Elementary and 
Secondary 
Education Act 
(ESEA) of 1965- 
Amendment 
(Representative 
Hurd) 

H.R. 5 


The Student 
Digital Privacy and 
Parental Rights 
Act of 2015 

(Representatives 
Polis & Messer) 
H.R. 2092.IH 


The Children's 
Online Privacy 
Protection Act of 
1998 (COPPA) 

(as is exists today) 


The SAFE KIDS 
Act 

(Senators 
Blumenthal & 
Daines) 


Do Not Track Kids 
Act of 2015 
(COPPA 
Amendment Act) 

(Senator Markey; 
Representative 
Barton) 

H.R. 2734 


ESEA Amendment 

(Senators Markey & 
Hatch) 
S.1177 


Level of 

education 

targeted: 

P-20 

P-20 

P-20 

K-12 

K-12 

K-12 

Children under 
the age of 13. 

P-12 

Any child under 
age 17 (previously 
COPPA only 
covered up to age 
13) 

N/A 

Enforcement 

Authority: 

United States 
Department of 
Education 

United States 
Department of 
Education 

United States 
Department of 
Education 

United States 
Department of 
Education and 
private right of 
action (parents/ 
students can sue) 

United States 
Department of 
Education 

Federal Trade 
Commission (with 
DoE consultation 
when enforcement 
involves 
education 
agencies or 
institutions). 
Enforced against 
non-profits as 
well as for-profit 
companies. 

Federal Trade 
Commission 
enforces 
violations of 
COPPA as unfair 
or deceptive trade 
practices 

Federal Trade 
Commission (with 
DoE consultation 
when enforcement 
involves 
education 
agencies or 
institutions). 
Enforced against 
non-profits as 
well as for-profit 
companies. 

Federal Trade 
Commission as 
well as state 
Attorneys General 
and other agencies 
as authorized by 
statute 

The Committee 
will consider and 
provide 

recommendations 
on the appropriate 
federal 
enforcement 
authorities for 
protecting student 
privacy. 


STANDARDS AND GOALS 


Strikes a good 

Enabled 

Provides key 

Makes positive 

Introduces 

N/A 

Provides key 

Establishes 

Establishes data 

Updates COPPA 

N/A 

balance 

technological 

privacy 

privacy updates to 

significant limits 


privacy 

critical privacy 

privacy 

for new 


between 

innovation over 

protections, 

FERPA without 

to data practices 


protections 

protections for 

protections 

technologies in 



the last four 

mostly without 

impeding 

that pose clear 


without 

children while not 

without imposing 

order to protect 



decades, but the 

undermining 

innovation 

challenges to the 


undermining 

limiting 

heavy burdens on 

the privacy of 



privacy 

positive data use 


continued use of 


positive data use 

innovation for 

service providers 

children, but still 



protections have 

practices. 


data for classroom 


practices 

web services 


enables industry 



had to be 



innovation 



generally 


innovation 


and technology 

extensively 










use 

supplemented by 
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INFORMATION 


The Family 
Educational Rights 
and Privacy Act of 
1974 (FERPA) 

(as it exists today) 


FERPA Discussion 
Draft 

(Representatives 
Kline & Scott) 


Protecting Student 
Privacy Act 

(Senators Markey & 
Hatch) 
S.1322.IS 


Student Privacy 
Protection Act 

(Senator Vitter) 
S.1341.IS 


Elementary and 
Secondary 
Education Act 
(ESEA) of 1965- 
Amendment 
(Representative 
Hurd) 

H.R. 5 


The Student 
Digital Privacy and 
Parental Rights 
Act of 2015 

(Representatives 
Polis & Messer) 
H.R. 2092.IH 


The Children's 
Online Privacy 
Protection Act of 
1998 (COPPA) 

(as is exists today) 


The SAFE KIDS 
Act 

(Senators 
Blumenthal & 
Daines) 


Do Not Track Kids 
Act of 2015 
(COPPA 
Amendment Act) 

(Senator Markey; 
Representative 
Barton) 

H.R. 2734 


ESEA Amendment 

(Senators Markey & 
Hatch) 
S.1177 



federal regulations 
and guidance in 
order to keep up 
with current 
technologies 










Remains 

relevant as 
technology 
evolves 

• Lack of 

forward- 
looking 
definitions 
limits the 
law’s 

continued 

application 

Provides room for 
agencies/institutio 
ns to continue to 
adapt to changing 
technology. 

Provides room 

for 

agencies/instituti 
ons to continue to 
adapt to changing 
technology 

Limitations 
imposed on data 
practices restrict 
the law’s 
continued 
relevance 

N/A 

Provides room 

for 

agencies/instituti 
ons to continue to 
adapt to changing 
technology 

Lack of forward- 
looking 

definitions limits 
the law’s 
continued 
application 

Provides room 

for 

agencies/instituti 
ons to continue to 
adapt to changing 
technology 

Provides room 

for 

agencies/instituti 
ons to continue to 
adapt to changing 
technology 

N/A 

Is easy for 
educational 
agencies/institu 
tions to 
implement 

Established 

mostly 

straightforward 
framework for 
implementation, 
though many 
exceptions to its 
privacy rules 
create complexity 
in implementation 

Although the bill 
includes many 
positive updates to 
FERPA that 
should not pose 
difficulties to 
implementation, 
there are 
significant 
burdens put on 
educational 
agencies and 
institutions (and 
state education 
agencies) in order 
for them to, for 

Requires few 
changes from 
FERPA 
framework, but 
does add duty to 
monitor 
compliance of 
service providers 

Contains serious 
challenges for 
implementation 

N/A 

Establishes 
straightforward 
framework for 
implementation 

The FTC has 
interpreted 

COPPA as 
enabling schools 
to provide consent 
on behalf of 

students. 

Establishes 
straightforward 
framework for 
implementation 

Authorizes 
schools to grant 
consent on behalf 
of students, 
handling consent 
similar to COPPA 

As long as the 

FTC continues to 
interpret COPPA 
to allow schools 
to provide consent 
on behalf of 
students, this law 
should be simple 
to implement for 
educational 
agencies/institutio 
ns. Elowever, 
since the law 
would 
significantly 
expand the legal 

N/A 
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The Family 
Educational Rights 
and Privacy Act of 
1974 (FERPA) 

(as it exists today) 


FERPA Discussion 
Draft 

(Representatives 
Kline & Scott) 


Protecting Student 
Privacy Act 

(Senators Markey & 
Hatch) 
S.1322.IS 


Student Privacy 
Protection Act 

(Senator Vitter) 
S.1341.IS 


Elementary and 
Secondary 
Education Act 
(ESEA) of 1965- 
Amendment 
(Representative 
Hurd) 

H.R. 5 


The Student 
Digital Privacy and 
Parental Rights 
Act of 2015 

(Representatives 
Polis & Messer) 
H.R. 2092.IH 


The Children's 
Online Privacy 
Protection Act of 
1998 (COPPA) 

(as is exists today) 


The SAFE KIDS 
Act 

(Senators 
Blumenthal & 
Daines) 


Do Not Track Kids 
Act of 2015 
(COPPA 
Amendment Act) 

(Senator Markey; 
Representative 
Barton) 

H.R. 2734 


ESEA Amendment 

(Senators Markey & 
Hatch) 
S.1177 




example, have the 
resources to 
adequately verify 
that each third 
party they contract 
with has industry- 
standard security. 







requirements for 
companies 
contracting with 
educational 
agencies/ 
institutions, that 
could make the 

law more difficult 
to implement for 
both educational 
agencies and 
service providers 


Provides clear, 
understandable 

definitions of 
key terms 

Defines some key 
terms but leaves 
many ambiguous 
or subject to major 
exceptions 

Definitions are 
mainly clear, but 
this bill 
substantially 
changes the 
definition of 
“educational 
agency or 
institution” by 
separating out 
“state education 
authorities” 
(commonly 
known as state 

education 

agencies). 

Does little to build 
on FERPA 
definitions 

Provides 
definitions for 
many key terms 
but leaves 
ambiguity in 
several others 

N/A 

Introduces clear 
definitions for key 
terms such as 
personally 
identifiable 
information and 
covered 
information 

Provides some 
definitions but has 
failed to stay 
relevant 

Mostly defers to 
FTC rulemaking 
to establish clear 
definitions for key 
terms 

Offers clear 
definitions 
building on 

COPPA, such as 
updating 
“operator” and 
“geolocational 
data” 

The Committee 
may provide or 
update definitions 
for terms such as 
“(i) education 
record; (ii) 
personally 
identifiable 
information; (iii) 
aggregated, de- 
identified, or 
anonymized data; 
(iv) third-party; 
and (v) educational 
purpose” 

Bans the use of 
data for 

Not explicitly, but 
provides some 

No parties with 
access to an 

No funds will be 
provided to 
institutions 

Continues the 

current version of 

N/A 

Service providers 
are prohibited 

Though applying 
only to websites 

Service providers 
are prohibited 

Prohibits online 
service providers 

The Committee 

will ensure that 
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INFORMATION 


The Family 
Educational Rights 
and Privacy Act of 
1974 (FERPA) 

(as it exists today) 


FERPA Discussion 
Draft 

(Representatives 
Kline & Scott) 


Protecting Student 
Privacy Act 

(Senators Markey & 
Hatch) 
S.1322.IS 


Student Privacy 
Protection Act 

(Senator Vitter) 
S.1341.IS 


Elementary and 
Secondary 
Education Act 
(ESEA) of 1965- 
Amendment 
(Representative 
Hurd) 

H.R. 5 


The Student 
Digital Privacy and 
Parental Rights 
Act of 2015 

(Representatives 
Polis & Messer) 
H.R. 2092.IH 


The Children's 
Online Privacy 
Protection Act of 
1998 (COPPA) 

(as is exists today) 


The SAFE KIDS 
Act 

(Senators 
Blumenthal & 
Daines) 


Do Not Track Kids 
Act of 2015 
(COPPA 
Amendment Act) 

(Senator Markey; 
Representative 
Barton) 

H.R. 2734 


ESEA Amendment 

(Senators Markey & 
Hatch) 
S.1177 


commercial 
purposes, such 
as advertising 

restrictive 
guidelines for use 
and disclosure of 

information 
without consent 

educational record 
or the PII 
contained therein 

can use that 
information to 
market to students 

releasing or 
providing access 
to service 
providers for 
advertising 
purposes 

FERPA’s ban on 
“the collection, 
disclosure, or use 
of personal 
information 
collected from 
students for the 
purpose of 
marketing or for 
selling that 
information” 


from selling 
covered 
information or 
using it for 
targeting 
advertising 

providing 
commercial 
purposes, it does 
not prohibit the 
use of data for 
those purposes. 

from selling 
covered 
information or 
using it for 
targeting 
advertising 

from using data 
for “targeted 
marketing 
purposes” without 
consent. 

identifiable data 
cannot be used for 
targeting 
advertising or 
marketing 
purposes 

Includes 

Information 

Requires a written 

Third parties must 

Third parties must 

N/A 

No profiles can be 

Third parties 

Both third parties 

Third parties 

The Committee 

provisions 

transferred to third 

agreement 

have security 

de-identify 


created for 

generally must 

and their 

generally must 

can establish best 


parties cannot be 

between third 

systems to protect 

student data; 


marketing or 

obtain consent for 

subcontractors are 

obtain consent for 

practices for any 


shared further 

parties and 

students’ 



advertising; 

collecting and 

bound to follow 

collecting and 

entity that comes 


without written 

education 

personally 

Third parties must 



using data if the 

the privacy 

using data 

into contact with 


parental consent, 

agencies or 

identifiable 

destroy student 


Sub-contractors 

service is directed 

protections 


student education 


and violations by 

institutions that 

information; 

data when a 


are bound under 

at children 


Minors or their 

records, including 

data 

third parties can 

must include: how 


student is no 


the law; 



parents have the 

best practices for 


be enforced by 

and what 

Any education 

longer serviced by 





right to inspect the 

data deletion and 


prohibited access 

information will 

records held by 

the agency or 


Reasonable 



data collected on 

minimization 


to data in the 

be transferred, and 

third parties must 

institution; 


security required; 



them, challenge 



future 

what PII will be 

be maintained in a 






it’s accuracy, and 




created;a 

manner that 

Third parties must 


Aggregated 



demand that the 




description of any 

allows parents to 

accept liability for 


student data can 



data be “erased, 




subcontractors; 

access their 

any violations as 


be used to 



corrected... or 




not allowing the 

students’ data and 

condition for 


improve products 



otherwise 




sharing of PII; an 

a process for 

receiving access 


or for research 



amended” 




assurance of 

corrections; 










development of 

Third parties must 
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FERPA Discussion 
Draft 

(Representatives 
Kline & Scott) 


Protecting Student 
Privacy Act 

(Senators Markey & 
Hatch) 
S.1322.IS 


Student Privacy 
Protection Act 

(Senator Vitter) 
S.1341.IS 


Elementary and 
Secondary 
Education Act 
(ESEA) of 1965- 
Amendment 
(Representative 
Hurd) 

H.R. 5 


The Student 
Digital Privacy and 
Parental Rights 
Act of 2015 

(Representatives 
Polis & Messer) 
H.R. 2092.IH 


The Children's 
Online Privacy 
Protection Act of 
1998 (COPPA) 

(as is exists today) 


The SAFE KIDS 
Act 

(Senators 
Blumenthal & 
Daines) 


Do Not Track Kids 
Act of 2015 
(COPPA 
Amendment Act) 

(Senator Markey; 
Representative 
Barton) 

H.R. 2734 


ESEA Amendment 

(Senators Markey & 
Hatch) 
S.1177 




policies and 
procedures that 
ensure data 
security using 
commonly 
accepted industry 
standards; 
penalties; and 
provisions 
specifying 
acceptable uses by 
the third party of 
the PII. 

maintain a record 
of all individuals, 
agencies, or 
organizations 
which request or 
obtain student 
data; 

Must destroy all 
personally 
identifiable 
information of 
students when the 

information is no 
longer needed for 
its specified 
purpose 








Acknowledges 
the importance 
of data for 
personalized 
learning 

N/A 

Enables education 
service providers 
to provide 
personalized 
learning. 

N/A 

Limits use of 
personalized 
learning 

N/A 

Does not “limit 
the ability of an 
operator to use 
information.. .for 
personalized 
student learning” 

N/A 

Does not “limit 
the ability of an 
operator to use 
information.. .for 
personalized 
student learning” 

N/A 

N/A 
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Educational Rights 
and Privacy Act of 
1974 (FERPA) 

(as it exists today) 


FERPA Discussion 
Draft 

(Representatives 
Kline & Scott) 


Protecting Student 
Privacy Act 

(Senators Markey & 
Hatch) 
S.1322.IS 


Student Privacy 
Protection Act 

(Senator Vitter) 
S.1341.IS 


Elementary and 
Secondary 
Education Act 
(ESEA) of 1965- 
Amendment 
(Representative 
Hurd) 

H.R. 5 


The Student 
Digital Privacy and 
Parental Rights 
Act of 2015 

(Representatives 
Polis & Messer) 
H.R. 2092.IH 


The Children's 
Online Privacy 
Protection Act of 
1998 (COPPA) 

(as is exists today) 


The SAFE KIDS 
Act 

(Senators 
Blumenthal & 
Daines) 


Do Not Track Kids 
Act of 2015 
(COPPA 
Amendment Act) 

(Senator Markey; 
Representative 
Barton) 

H.R. 2734 


ESEA Amendment 

(Senators Markey & 
Hatch) 
S.1177 


Includes robust 

transparency 

requirements 

Robust notice 
requirements 
govern when 
educational 
agencies make 
public directory 
information or 

seek to disclose 
other student 
information 

Educational 
agencies or 
institutions must 
requiring 
educational 
agencies and 

SEAs to provide 
parents with 
copies of written 
agreements with 
third parties; 
requiring third 
parties to spell out 
their 

use/storage/protec 
tion of data in 
their written 
agreements with 
EAIs; and 
requiring EAIs to 
notify parents 
about how that 
third party will 
protect the data 

Third parties must 
maintain records 
of all individuals, 
agencies, or 
organizations that 
have requested or 
obtained access to 

student data. 

Thirty days of 
notice must be 
provided to 
parents before 
third parties have 
access to student 
data. Public 
hearings must be 
held before 
classroom video 
monitoring can be 
put in place. 

N/A 

Companies must 
publicly list what 
type of data they 
collect or 
generate, how it is 
used, and whether 
it is shared. This 

information must 
be clear and easy 
to understand. 

Contains notice 
provisions stating 
“what information 

is collected from 
children by the 
operator, how the 
operator uses such 
information, and 
the operator’s 
disclosure 
practices for such 
information.” 

Companies must 
identify to schools 
what type of data 
they collect or 
generate, how it is 
used, and whether 
it is shared. 

Service providers 
must also have a 
publicly-posted 
privacy policy, 
even if the 
product interfaces 
directly with the 
school rather than 
individual 
students, but 
contracts are not 
required to be 
posted publicly. 

Operators of 
online services 
and applications 
must “provide 
clear and 
conspicuous 
notice in clear 
and plain 
language of the 
types of personal 
information” 
collected and 
how it is used 

The Committee 
can provide 
recommendations 
regarding 
transparency, such 
as providing 
parental notice of 
data collection and 
access rights 

Creates new 
parental rights 
(in addition to 
the parental 
rights in 

FERPA 

N/A 

State Education 
Agencies shall set 
the procedures by 
which parents can 
access their 
child’s record 

Clarifies that 
parents shall have 
the right to access 
personally 
identifiable 
information held 

No third party 
may access 

student data 
without parental 
consent. 

N/A 

Parents may grant 
or withhold 

consent for the 
use or disclosure 
of protected 
student 

Parents have the 
right to 

grant/withhold 
consent for the 
collection, use, 
and disclosure of 

Schools rather 
than parents 
consent to third 
party data 
practices, and 
parental access to 

Requires 
operators “to 
obtain verifiable 
consent” from 
parents for the 
collection, use, or 

The Committee 
will consider 
establishing best 
practices for 
ensuring that 
parents have notice 
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The Family 
Educational Rights 
and Privacy Act of 
1974 (FERPA) 

(as it exists today) 


FERPA Discussion 
Draft 

(Representatives 
Kline & Scott) 


Protecting Student 
Privacy Act 

(Senators Markey & 
Hatch) 
S.1322.IS 


Student Privacy 
Protection Act 

(Senator Vitter) 
S.1341.IS 


Elementary and 
Secondary 
Education Act 
(ESEA) of 1965- 
Amendment 
(Representative 
Hurd) 

H.R. 5 


The Student 
Digital Privacy and 
Parental Rights 
Act of 2015 

(Representatives 
Polis & Messer) 
H.R. 2092.IH 


The Children's 
Online Privacy 
Protection Act of 
1998 (COPPA) 

(as is exists today) 


The SAFE KIDS 
Act 

(Senators 
Blumenthal & 
Daines) 


Do Not Track Kids 
Act of 2015 
(COPPA 
Amendment Act) 

(Senator Markey; 
Representative 
Barton) 

H.R. 2734 


ESEA Amendment 

(Senators Markey & 
Hatch) 
S.1177 


already) 


Parents can access 
their child’s data 
that is held by 
third parties 
through their 
school or local 
education agency 

Specifically does 
not preempt state 
law, allowing 
states to provide 
parents with 
additional rights 

about their 
students by an 
outside party and 
have a process to 
challenge, correct, 
or delete any 
inaccurate data 

within those 
records. 

Parents can access 
student data held 
by institutions or 
third parties. 

Classroom video 
monitoring 
requires public 
hearing and 
written consent 
from all parents of 
all the students in 
the classroom. 


information and 
have the right to 
access their 

student’s 
personally 
Identifiable 
information (PII) 
held by an outside 
party. They can 
challenge, correct, 
or delete 
inaccurate data. 

Parents may 
request third 
parties to delete 
their student’s 
data (except for 
data required to be 
maintained by 
federal or state 
law). 

their children’s 
data as well as to 

access 

information 

collected. 

data is provided 
through the 
schools 

disclosure of 
information about 
their children, but 
FTC has allowed 
schools to give 
consent for 
students using 
educational 
services 

Also grants 
parents the right 
to access collected 

data 

of when data is 
collected and what 
rights they have to 
seek the 
amendment, 
deletion, or 
modification of 

that data 

Provides for 
training and 
capacity¬ 
building 

No provisions 

No provisions 

No provisions 

No provisions 

No provisions 

No provisions 

No provisions 

No provisions 

No provisions 

The Committee 
can recommend 
best practices for 
local entities 
handling student 
data to include 
professional 
development for 
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S.1341.IS 
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Secondary 
Education Act 
(ESEA) of 1965- 
Amendment 
(Representative 
Hurd) 

H.R. 5 


The Student 
Digital Privacy and 
Parental Rights 
Act of 2015 

(Representatives 
Polis & Messer) 
H.R. 2092.IH 


The Children's 
Online Privacy 
Protection Act of 
1998 (COPPA) 

(as is exists today) 
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Act 
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Blumenthal & 
Daines) 
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Act of 2015 
(COPPA 
Amendment Act) 

(Senator Markey; 
Representative 
Barton) 

H.R. 2734 


ESEA Amendment 

(Senators Markey & 
Hatch) 
S.1177 












employees 

Sets penalties 
for 

noncompliance 
and violations 
(in addition to 
the existing 
FERPA penalty 
of withdrawal 
of all federal 

funds or 
remediation) 

Department of 
Education has 
authority to 
withhold funds 
and/or bring 
schools into 
compliance 

No private right of 
action 

The Secretary of 
Education can fine 
educational 
agencies or 
institutions if they 
do not come into 
voluntary 
compliance, up to 
either $1.5 million 
or 10% of their 
annual budget. 

The Secretary of 
Education can 
refer third party 
violations to the 
Federal Trade 
Commission 
and/or the 

Attorney General. 

No penalties 
beyond FERPA 
enforcement 
mechanisms (no 
private right of 
action, but 
Department of 
Education has 
authority to 
withhold funds 
and/or bring 
schools into 
compliance) 

Private right of 
action; graduated 
levels of 
mandatory fines 
per individual data 
violation per 
individual student. 

N/A 

Federal Trade 
Commission can 
fine, bring court 
cases, and has 
other enforcement 

abilities. 

Federal Trade 
Commission can 
issue civil 
penalties and 
bring actions for 
unfair or 
deceptive trade 
practices against 
operators that 
violate data 
collection, use, 
and disclosure 
rules. 

Also empowers 
state Attorneys 
General to bring 
actions for 
violations. 

Federal Trade 
Commission can 
fine, bring court 
cases, and has 
other enforcement 

abilities. 

Federal Trade 
Commission can 
bring actions for 
unfair or 
deceptive trade 
practices against 
operators that 
violate data 
collection, use, 
and disclosure 

rules. 

Also empowers 
state Attorneys 
General to bring 
actions for 
violations. 

N/A 

Addresses 

education 
research (that 
can be used to 
help SBE 
members make 

educated 

decisions) 

Generally limits 
research uses 
without consent. 

Researchers 
conducting studies 
for or on behalf of 

an educational 
agency or 
institution do not 
need parental 
consent for access 
to student data, 

No provisions. 

Only aggregated, 
anonymized, and 
de-identified data 
may be used for 
the development 
or improvement of 
products and 
services. 

N/A 

Not relevant to 
researchers unless 
they work for a 
company - if a 
company is 
funding or doing 
educational 
research using the 
student data it 

No provisions. 

No provisions. 

No provisions. 

The Committee 
will address data 
sharing to include 
considering how 
student data can be 
protected when 
used for research 
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H.R. 2734 


ESEA Amendment 
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but they must 
destroy that data 
after use, employ 
data security 
safeguards, and 
ensure that 
students cannot be 

reidentified 

Researchers 
cannot conduct 
studies for SEAs, 
or when the 
purpose of the 
study is not 
regarding 
“improving the 
instruction or 
testing of students 
attending that” 
educational 
agency or 
institution. 


Any release of 
student data to 
third parties must 
be approved by 
parents. 

No funds may be 
used to support 
federally- 
sponsored 
research on social- 
emotional data in 
education. 


holds, that data 
must be 

aggregated before 
research is 
conducted. 





Addresses data 
security 
(through 
training, data 
breach 

procedures, or 
data 

No provisions. 

Requires general 
security 
provisions for 
both education 
agencies and third 
parties. 

No funds shall be 
made available to 
any educational 
agency or 
institution that has 
not implemented 
information 

No provisions. 

N/A 

Operators and 

subcontractors 

must establish, 

implement, and 

maintain 

reasonable 

security 

Contains only 
general provisions 
requiring online 
services to protect 
the security of PII 
and of its website. 

Operators and 

subcontractors 

must establish, 

implement, and 

maintain 

reasonable 

security 

Provides guideline 
that “the personal 
information of a 

minor should be 
protected by 
reasonable and 
appropriate 

No provisions. 


www.nasbe.org - Page li 


http://nepc.colorado.edu/publication/schoolhouse-commercialism-2015 37 of 58 















KEY 

INFORMATION 


The Family 
Educational Rights 
and Privacy Act of 
1974 (FERPA) 

(as it exists today) 


FERPA Discussion 
Draft 

(Representatives 
Kline & Scott) 


Protecting Student 
Privacy Act 

(Senators Markey & 
Hatch) 
S.1322.IS 


Student Privacy 
Protection Act 

(Senator Vitter) 
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Act of 2015 
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H.R. 2734 


ESEA Amendment 
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S.1177 


governance 

measures) 


security policies 
and procedures 
that protect 
student PII 
maintained by the 
educational 
agency or 
institution. 

Each third party 
possessing PII 
must have 
information 
security policies 
and procedures, 
including a 
comprehensive 
security program 
designed to 
protect PII. 


procedures to 
protect covered 
information. 

Operators must 
have data breach 
procedures and 
policies, must 
notify the Federal 
Trade 

Commission and 
other appropriate 
parties of each 
instance of 
unauthorized 
access to 
personally 
identifiable 
information (PII). 


procedures to 
protect covered 
information. 

Does not impose 
breach 
notification 
requirements on 
service providers 


safeguards against 
risks such as loss 
or unauthorized 
access, 

destruction, use, 
modification, or 
disclosure” 
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